`journal` note: not logging — review delivered in conversation, no artefact changed.

## Verdict
VERDICT: DO-NOT-SHIP (2 findings) - 14 of 15 round-1 findings are cleanly CLOSED and the fixes are well-made, but the precedence fix left its own documentation stating the inverse rule, and the popup half of the keyboard fix stopped one attribute short. Both are one-line remedies; after them this ships.

## Per-fix verification (round-1 order)

1. **Session rows keyboard - CLOSED (panel) / STILL-OPEN residue (popup, MINOR)** - `src/core/panel.ts:1280-1281` (`role="button"`, `tabIndex=0`), `:1374-1378` (Enter/Space open, Space scroll suppressed), `:1382-1388` (ContextMenu key and Shift+F10 open the menu anchored on the row rect). Caret `aria-hidden` at `:1231`. Popup rows are focusable with Enter-to-switch (`src/core/popup.ts:332-338`) - functionally reachable - but see finding 2 below.
2. **Launch modal exit - CLOSED** - `src/core/terminals.ts:46` adds `Dialog.cancelButton()`; the comment (`:31-33`) honestly scopes Cancel to dismissing the scrim. Double-dispose via the `finally` at `:180` is safe on Lumino dialogs.
3. **Delete confirmation - CLOSED** - two-step arming at `popup.ts:69-73, 383-392`: first click arms `Confirm delete N` (filled error style, `style/base.css:860-865`), 4 s timer or any selection change disarms (`popup.ts:267, 322, 354`); trash-mode deletes stay one-click, which is the right calibration. No nested dialog.
4. **Gemini yolo/approval contradiction - CLOSED in behaviour** - `src/core/modes.ts:20-45` (`resolveLaunchMode`: force > off-default enum > boolean), wired at `panel.ts:700`, asserted by 4 Jest cases (`src/__tests__/launch-mode.spec.ts`, all passing - suite re-run here, 61/61). `approvalMode: plan` + `yoloMode: on` now launches `--approval-mode plan`. But see finding 1 below - the copy still states the old rule.
5. **"retrying" copy - CLOSED** - `_showActionError` (`panel.ts:511-517`) wired at the three triaged sites: favourite rollback `:562`, project removal `:601`, native-flag branch `:833`. Remaining `_showError` callers (`:687, :764, :860, :906`) are exactly the declined/escalated set - not re-raised.
6. **Absolute time - CLOSED** - tooltip reads `Last activity: YYYY-MM-DD HH:MM (3d ago)`, absolute first (`panel.ts:1426-1430`, `_formatAbsoluteTime` `:1516-1523`); `mo`/`y` buckets added (`:1505-1511`).
7. **Hit targets - CLOSED** - `.jp-AiAssistantsPanel-iconButton` 24×24 with 14px glyph (`base.css:50-77`); `searchClear` widened to 24px (`:127`), height bound to the input it lives in - acceptable, the control cannot outgrow its field.
8. **Reduced motion - CLOSED** - `@media (prefers-reduced-motion: reduce)` stills all three spin surfaces at 0.5 opacity (`base.css:434-443`); the 500 ms spin floor is skipped in code (`panel.ts:124-129, 201-203`) - the code-side skip is the detail most teams miss.
9. **SR-silent status - CLOSED** - dot `aria-label` (`panel.ts:1400-1410`), error strip `role="status"` (`:361`).
10. **Empty vs filtered - CLOSED** - `No matches.` under an active filter, `Empty.`/`No favorites yet.` otherwise (`panel.ts:1252-1258`).
11. **Empty panel hint - CLOSED** - "Use + to start a session in the current folder." (`panel.ts:1176-1179`).
12. **Shield glyph - CLOSED** - `warningIcon` (Material warning triangle, `icons.ts:51-61`) on all three unsafe variants (`panel.ts:1604, 1618, 1623`); `shieldIcon` fully removed from `src/`.
13. **Text carets - CLOSED** via the minimum remedy I offered (`aria-hidden="true"`, `panel.ts:1231`); LabIcon replacement was declined - not re-raised.
14. **Filter aria-labels - CLOSED** - `panel.ts:311`, `popup.ts:81`.
15. **Popup width - CLOSED** - `min-width: min(360px, 90vw)` (`base.css:567`); bg-chip half was declined - not re-raised.

## Findings

- **[MINOR] Launch-mode settings copy states the inverse of the implemented precedence** - `src/providers/gemini.ts:71` and its mirror `schema/plugin.json:75` still say the approval ladder applies "…and when no boolean launch mode overrides it" - the round-1 (boolean-wins) rule. `resolveLaunchMode` now does the opposite: an off-default enum beats the boolean. A user who wants YOLO, reads this description in Settings, and leaves `approvalMode: plan` set will launch read-only while the copy told them the boolean would override - confusion on the exact safety surface the fix was for (the error is at least in the safe direction). Fix: reword both strings to the new rule, e.g. "…set to a value other than the default; a non-default value here takes precedence over the YOLO switch." This is a fix-introduced regression in a touched file, not a re-litigation.

- **[MINOR] Popup switch rows are focusable but semantically anonymous** - `src/core/popup.ts:332-338` gives branch rows `tabIndex=0` and Enter-to-switch, but no `role="button"` and no Space handling, unlike the panel rows the same fix upgraded (`panel.ts:1280-1281, 1374`). A screen-reader user tabs onto a generic div with no announced role or action - nothing says Enter switches; the row's one unlabelled action stays undiscoverable non-visually (Open/copy are real buttons, so the row is not a dead end - hence MINOR, not a reopen of the CRITICAL). Fix: `row.setAttribute('role', 'button')` plus the same Space branch the panel rows use, or an `aria-label` naming the switch action.

## What works

- The two-step arming is a model implementation - the armed state disarms on every selection mutation (checkbox, select-all, row-toggle), the filled-error style makes the destroying click visually distinct from the arming click, and trash-mode deletes correctly stay one-click
- The reduced-motion fix went beyond the CSS block to kill the artificial 500 ms spin floor in code (`panel.ts:201-203`) - the half of the finding a CSS-only fix would have missed
- `resolveLaunchMode` as its own asserted module turns the precedence rule from an inline hazard into a tested contract; the "enum is the explicit statement of intent" rationale in the doc comment is exactly right - it just needs the settings copy to agree with it
- Error-copy discipline: `_showActionError`'s doc comment ("nothing retries it, so the copy names what did not happen") encodes the principle, not just the patch, so future call sites inherit the distinction
